//! Terraform and OpenTofu state, kept by the hub per repository
//! (oxygenhub#252): the HTTP backend Terraform and OpenTofu speak, with
//! locking, at `/api/v1/repos/OWNER/NAME/terraform/state/STATE`, so a Flow
//! job keeps its state without any cloud credential. A job authenticates
//! with an identity token of this hub's for the audience `{base}/terraform`
//! (its pipeline's `identity` block) or its runner's job token, either for
//! its own repository only; people with a token of theirs and their
//! repository role. Tokens go as the bearer, or as the password of Basic
//! auth, which is what the backend sends.
//!
//! State is kept outside the repository's history (it often holds secrets),
//! sealed at rest with the hub's secrets key, and its last versions are
//! kept, so a bad apply can be rolled back: a kept version is restored as a
//! new one (#255), so nothing is lost and going forward again is restoring
//! a newer one.

use crate::api::ApiError;
use crate::auth::roles::{Access, Role};
use crate::{db, Shared};
use axum::body::Bytes;
use axum::extract::{Path, Query, State};
use axum::http::{header, HeaderMap, Method, StatusCode};
use axum::response::{IntoResponse, Response};

/// Versions of a state kept besides the current one.
pub const VERSIONS_KEPT: i64 = 20;
/// The most a state may weigh.
pub const MAX_STATE_BYTES: usize = 32 << 20;

/// Who may use a repository's states.
enum Who {
    /// A running job of this repository.
    Job { name: String },
    /// A person, with their role on the repository.
    Person { account: Box<db::accounts::Account>, role: Role },
}

impl Who {
    fn label(&self) -> String {
        match self {
            Who::Job { name } => name.clone(),
            Who::Person { account, .. } => account.username.clone(),
        }
    }

    fn may(&self, access: Access) -> bool {
        match self {
            // A job reads and writes its own repository's states.
            Who::Job { .. } => true,
            Who::Person { role, .. } => crate::auth::roles::allows(Some(*role), access),
        }
    }
}

fn err(status: StatusCode, why: impl Into<String>) -> ApiError {
    ApiError(status, why.into())
}

/// The token a request carries: the bearer, or Basic auth's password.
fn token_of(headers: &HeaderMap) -> Option<String> {
    if let Some(t) = oxy_server::bearer_token(headers) {
        return Some(t.to_string());
    }
    let v = headers.get(header::AUTHORIZATION)?.to_str().ok()?;
    let b64 = v.strip_prefix("Basic ").or_else(|| v.strip_prefix("basic "))?;
    let raw = String::from_utf8(oxy_core::dsse::base64_decode(b64.trim())?).ok()?;
    let (_, password) = raw.split_once(':')?;
    (!password.is_empty()).then(|| password.to_string())
}

/// The audience a job's identity token needs here.
pub fn audience(base_url: &str) -> String {
    format!("{}/terraform", base_url.trim_end_matches('/'))
}

fn valid_name(name: &str) -> bool {
    !name.is_empty()
        && name.len() <= 100
        && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
        && !name.starts_with('.')
}

async fn who(app: &Shared, headers: &HeaderMap, row: &db::repos::RepoRow) -> Result<Who, ApiError> {
    let token = token_of(headers).ok_or_else(|| {
        err(StatusCode::UNAUTHORIZED, "a Terraform state needs a token: a job's (TF_HTTP_PASSWORD), or one of yours with repo:write")
    })?;
    let hash = crate::auth::token_hash(&token);
    if token.starts_with(crate::flow::JOB_TOKEN_PREFIX) {
        let job = db::flow::job_by_token(&app.db, &hash, crate::flow::JOB_TOKEN_MAX_AGE_MS)
            .await
            .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
            .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "this job token is not valid (the job must be running)"))?;
        let run = db::flow::run_by_id(&app.db, job.run_id)
            .await
            .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
            .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "this job token is not valid"))?;
        if run.repo_id != row.id {
            return Err(err(StatusCode::FORBIDDEN, "a job keeps the states of its own repository only"));
        }
        return Ok(Who::Job { name: format!("run #{} {}", run.number, job.name) });
    }
    let personal = db::accounts::token_by_hash(&app.db, &hash).await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
    let Some(token) = personal.filter(|t| !t.expired(db::now_ms())) else {
        // A job's identity token for this hub's Terraform audience.
        let issuer = app.oidc().await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
        let aud = audience(app.config.base_url());
        let Some(claims) = issuer.verify(&token, &aud, db::now_ms()) else {
            return Err(err(StatusCode::UNAUTHORIZED, format!("unknown or expired token (a job's identity token must be for {aud})")));
        };
        let sub = claims["sub"].as_str().unwrap_or("");
        let repo = claims["repository"]
            .as_str()
            .map(String::from)
            .or_else(|| sub.strip_prefix("repo:").and_then(|r| r.split_once(":bookmark:")).map(|(r, _)| r.to_string()));
        if repo.as_deref() != Some(row.slug().as_str()) {
            return Err(err(StatusCode::FORBIDDEN, "a job keeps the states of its own repository only"));
        }
        return Ok(Who::Job { name: sub.to_string() });
    };
    if !(token.has_scope("repo:write") || token.has_scope("repo:admin")) {
        return Err(err(
            StatusCode::FORBIDDEN,
            "the token lacks repo:write: a Terraform state, read or written, needs it (states hold secrets)",
        ));
    }
    let slug = row.slug();
    if !token.covers(&slug) {
        return Err(err(StatusCode::FORBIDDEN, format!("the token does not cover {slug}")));
    }
    let account = db::accounts::account_by_id(&app.db, token.account_id)
        .await
        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .filter(|a| !a.banned && !a.disabled)
        .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "unknown token"))?;
    let role = crate::auth::roles::role_for(&app.db, Some(&account), row)
        .await
        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
    match role {
        Some(r) if crate::auth::roles::allows(Some(r), Access::Read) => Ok(Who::Person { account: Box::new(account), role: r }),
        _ => Err(err(StatusCode::NOT_FOUND, "no such repository")),
    }
}

#[derive(serde::Deserialize, Default)]
pub struct LockQuery {
    #[serde(rename = "ID", default)]
    id: Option<String>,
}

fn json(status: StatusCode, body: String) -> Response {
    (status, [(header::CONTENT_TYPE, "application/json")], body).into_response()
}

/// The lock's ID in a lock-info body (`{"ID": …}`).
fn lock_id(info: &[u8]) -> Option<String> {
    serde_json::from_slice::<serde_json::Value>(info).ok()?.get("ID")?.as_str().map(String::from)
}

/// Why a restore did not happen.
pub enum RestoreError {
    /// No such version of that state.
    NotFound,
    /// Someone holds the state's lock: who.
    Locked(String),
    /// The kept body does not open or is not JSON.
    Broken,
    Db(sqlx::Error),
}

impl RestoreError {
    pub fn message(&self) -> String {
        match self {
            RestoreError::NotFound => "no such version of this state".into(),
            RestoreError::Locked(by) => format!("the state is locked by {by}: restore it once the lock is released"),
            RestoreError::Broken => "that version does not open: it cannot be restored".into(),
            RestoreError::Db(e) => e.to_string(),
        }
    }

    fn status(&self) -> StatusCode {
        match self {
            RestoreError::NotFound => StatusCode::NOT_FOUND,
            RestoreError::Locked(_) => StatusCode::LOCKED,
            RestoreError::Broken | RestoreError::Db(_) => StatusCode::INTERNAL_SERVER_ERROR,
        }
    }
}

/// Restore kept version `id` of a state (#255): written as a new version
/// whose serial is above the current one (OpenTofu and Terraform take a
/// state only forward), so the state it replaces is kept as a version too.
/// Refused while the state is locked. The new serial.
pub async fn restore(app: &Shared, repo_id: i64, state: &str, id: i64, by: &str) -> Result<i64, RestoreError> {
    let current = db::terraform::get(&app.db, repo_id, state).await.map_err(RestoreError::Db)?;
    if let Some(l) = current.as_ref().filter(|s| !s.lock_id.is_empty()) {
        return Err(RestoreError::Locked(l.locked_by.clone()));
    }
    let (body, old_serial) =
        db::terraform::version_body(&app.db, repo_id, state, id).await.map_err(RestoreError::Db)?.ok_or(RestoreError::NotFound)?;
    let plain = app.secret_key.open(&body).ok_or(RestoreError::Broken)?;
    let mut json: serde_json::Value = serde_json::from_str(&plain).map_err(|_| RestoreError::Broken)?;
    let serial = current.map_or(0, |c| c.serial).max(old_serial) + 1;
    json["serial"] = serial.into();
    let text = serde_json::to_string_pretty(&json).map_err(|_| RestoreError::Broken)?;
    let label = format!("{by}, restoring serial {old_serial}");
    db::terraform::put(&app.db, repo_id, state, &app.secret_key.seal(&text), serial, &label, VERSIONS_KEPT)
        .await
        .map_err(RestoreError::Db)?;
    Ok(serial)
}

/// `GET /api/v1/repos/{owner}/{name}/terraform/state/{state}/versions`:
/// the state's kept versions, newest first (#255).
pub async fn versions(
    State(app): State<Shared>,
    headers: HeaderMap,
    Path((owner, name, state)): Path<(String, String, String)>,
) -> Result<Response, ApiError> {
    let (row, _who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Write).await?;
    let list =
        db::terraform::version_list(&app.db, row.id, &state).await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
    let out: Vec<serde_json::Value> = list
        .iter()
        .map(|v| serde_json::json!({ "id": v.id, "serial": v.serial, "written_by": v.created_by, "written_ms": v.created_ms }))
        .collect();
    Ok(json(StatusCode::OK, serde_json::Value::Array(out).to_string()))
}

/// `GET …/terraform/state/{state}/versions/{id}`: one kept version's state.
pub async fn version(
    State(app): State<Shared>,
    headers: HeaderMap,
    Path((owner, name, state, id)): Path<(String, String, String, i64)>,
) -> Result<Response, ApiError> {
    let (row, _who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Write).await?;
    let (body, _) = db::terraform::version_body(&app.db, row.id, &state, id)
        .await
        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such version of this state"))?;
    let plain = app.secret_key.open(&body).ok_or_else(|| err(StatusCode::INTERNAL_SERVER_ERROR, "the version does not open"))?;
    Ok(json(StatusCode::OK, plain))
}

/// `POST …/terraform/state/{state}/versions/{id}/restore`: restore a kept
/// version, by a person with the maintain role (never a job), audited.
pub async fn restore_version(
    State(app): State<Shared>,
    headers: HeaderMap,
    Path((owner, name, state, id)): Path<(String, String, String, i64)>,
) -> Result<Response, ApiError> {
    let (row, who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Maintain).await?;
    let Who::Person { account, .. } = &who else {
        return Err(err(StatusCode::FORBIDDEN, "a job does not restore a state: a person with the maintain role does"));
    };
    let serial = restore(&app, row.id, &state, id, &account.username).await.map_err(|e| err(e.status(), e.message()))?;
    db::accounts::audit(
        &app.db,
        Some(account),
        "terraform.restored",
        &format!("{}:{state}", row.slug()),
        &format!("version {id}, now serial {serial}"),
    )
    .await
    .ok();
    Ok(json(StatusCode::OK, serde_json::json!({ "serial": serial }).to_string()))
}

/// The repository and the caller of a versions endpoint, allowed `access`.
async fn versions_caller(
    app: &Shared,
    headers: &HeaderMap,
    owner: &str,
    name: &str,
    state: &str,
    access: Access,
) -> Result<(db::repos::RepoRow, Who), ApiError> {
    if !valid_name(state) {
        return Err(err(StatusCode::BAD_REQUEST, "a state's name is letters, digits, '-', '_' and '.', up to 100"));
    }
    let row = db::repos::get(&app.db, owner, name)
        .await
        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such repository"))?;
    let who = who(app, headers, &row).await?;
    if !who.may(access) {
        return Err(err(
            StatusCode::FORBIDDEN,
            if access == Access::Maintain { "restoring a state needs the maintain role" } else { "a Terraform state needs the write role" },
        ));
    }
    Ok((row, who))
}

/// `GET|POST|DELETE|LOCK|UNLOCK /api/v1/repos/{owner}/{name}/terraform/state/{state}`.
pub async fn state(
    State(app): State<Shared>,
    method: Method,
    headers: HeaderMap,
    Path((owner, name, state)): Path<(String, String, String)>,
    Query(q): Query<LockQuery>,
    body: Bytes,
) -> Result<Response, ApiError> {
    if !valid_name(&state) {
        return Err(err(StatusCode::BAD_REQUEST, "a state's name is letters, digits, '-', '_' and '.', up to 100"));
    }
    let row = db::repos::get(&app.db, &owner, &name)
        .await
        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such repository"))?;
    let who = who(&app, &headers, &row).await?;
    // Reading a state needs the write role too: states hold secrets, and
    // every account reads a public or internal repository (#256).
    if !who.may(Access::Write) {
        return Err(err(StatusCode::FORBIDDEN, "a Terraform state needs the write role on its repository: states hold secrets"));
    }
    let db_err = |e: sqlx::Error| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string());
    let current = db::terraform::get(&app.db, row.id, &state).await.map_err(db_err)?;
    let locked = current.as_ref().filter(|s| !s.lock_id.is_empty());
    match method.as_str() {
        "GET" => match current.filter(|s| !s.body.is_empty()) {
            Some(s) => {
                let plain =
                    app.secret_key.open(&s.body).ok_or_else(|| err(StatusCode::INTERNAL_SERVER_ERROR, "the state does not open"))?;
                Ok(json(StatusCode::OK, plain))
            }
            // No state yet: Terraform starts afresh.
            None => Ok(StatusCode::NO_CONTENT.into_response()),
        },
        "POST" => {
            if body.len() > MAX_STATE_BYTES {
                return Err(err(StatusCode::PAYLOAD_TOO_LARGE, format!("a state may be {} MiB at most", MAX_STATE_BYTES >> 20)));
            }
            let text = std::str::from_utf8(&body).map_err(|_| err(StatusCode::BAD_REQUEST, "a state is JSON"))?;
            let parsed: serde_json::Value = serde_json::from_str(text).map_err(|_| err(StatusCode::BAD_REQUEST, "a state is JSON"))?;
            if let Some(l) = locked {
                if q.id.as_deref() != Some(l.lock_id.as_str()) {
                    return Ok(json(StatusCode::LOCKED, l.lock_info.clone()));
                }
            }
            let serial = parsed.get("serial").and_then(|v| v.as_i64()).unwrap_or(0);
            let sealed = app.secret_key.seal(text);
            db::terraform::put(&app.db, row.id, &state, &sealed, serial, &who.label(), VERSIONS_KEPT).await.map_err(db_err)?;
            Ok(StatusCode::OK.into_response())
        }
        "DELETE" => {
            if let Some(l) = locked {
                if q.id.as_deref() != Some(l.lock_id.as_str()) {
                    return Ok(json(StatusCode::LOCKED, l.lock_info.clone()));
                }
            }
            db::terraform::delete(&app.db, row.id, &state).await.map_err(db_err)?;
            Ok(StatusCode::OK.into_response())
        }
        "LOCK" => {
            let info = std::str::from_utf8(&body).unwrap_or("");
            let Some(id) = lock_id(body.as_ref()) else {
                return Err(err(StatusCode::BAD_REQUEST, "a lock request is the lock's JSON, with its ID"));
            };
            if let Some(l) = locked {
                return Ok(json(if l.lock_id == id { StatusCode::OK } else { StatusCode::LOCKED }, l.lock_info.clone()));
            }
            if db::terraform::lock(&app.db, row.id, &state, &id, info, &who.label()).await.map_err(db_err)? {
                Ok(json(StatusCode::OK, info.to_string()))
            } else {
                // Taken meanwhile.
                let now = db::terraform::get(&app.db, row.id, &state).await.map_err(db_err)?;
                Ok(json(StatusCode::LOCKED, now.map(|s| s.lock_info).unwrap_or_default()))
            }
        }
        "UNLOCK" => {
            let Some(l) = locked else { return Ok(StatusCode::OK.into_response()) };
            // `terraform force-unlock` sends the ID; a plain unlock its lock info.
            let id = lock_id(body.as_ref()).or(q.id.clone());
            if id.as_deref() != Some(l.lock_id.as_str()) {
                return Ok(json(StatusCode::CONFLICT, l.lock_info.clone()));
            }
            db::terraform::unlock(&app.db, row.id, &state).await.map_err(db_err)?;
            Ok(StatusCode::OK.into_response())
        }
        other => {
            Err(err(StatusCode::METHOD_NOT_ALLOWED, format!("{other} is not a Terraform backend method (GET, POST, DELETE, LOCK, UNLOCK)")))
        }
    }
}